Fix Guest Cannot Access a Team after a Tenant Migration

After a tenant-to-tenant migration, guests often lose access to Teams and SharePoint sites. The guest account may still appear in the team, but opening the team shows an error or a blank page. This happens because the guest’s identity is tied to the original tenant, and the migration breaks the cross-tenant relationship. This article explains why the access fails and provides step-by-step fixes to restore guest access.

You will learn how to re-invite guests, update the guest’s UPN, and verify permissions in the Teams admin center. We also cover related issues like missing SharePoint site access and broken OneDrive links.

Why Guest Access Fails After a Tenant Migration

When you migrate a tenant, the guest user objects are often copied or recreated in the target tenant. However, the guest’s underlying identity still points to their home tenant. In a tenant-to-tenant migration, the guest’s UserPrincipalName (UPN) may change, or the invitation redemption link becomes invalid. Teams and SharePoint rely on the guest’s UPN and the cross-tenant trust to grant access. If the UPN changes or the trust is not re-established, the guest cannot open the team.

Another common cause is that the team’s associated SharePoint site was migrated separately, and the guest’s permissions on that site were not carried over. Even if the guest appears in the team’s member list, the site-level permissions may be broken. This results in a “You don’t have access” error when the guest tries to open files or the site.

Finally, the guest’s account may be marked as “Invitation accepted” in the old tenant but not in the new tenant. The migration tool might copy the status, but the actual token issued to the guest is no longer valid. The guest must re-deem the invitation in the new tenant.

Steps to Restore Guest Access After a Tenant Migration

Follow these steps in order. Start with the least invasive action and escalate only if needed.

1. Resend the guest invitation from the Teams admin center
   Go to Teams admin center > Users > Guest users. Find the guest’s email address. Select the guest, then choose “Resend invitation.” This sends a new redemption link to the guest’s email. Ask the guest to click the link and sign in with their home tenant credentials.
2. Update the guest’s UPN in Azure AD
   If the guest’s UPN changed during migration, update it in Azure AD. Sign in to the Azure portal as a global admin. Go to Azure Active Directory > Users > All users. Find the guest, select “Edit” under User Principal Name, and enter the correct UPN. Save the change. Then ask the guest to sign out and sign in again.
3. Re-add the guest to the team
   In Teams, open the team and go to More options > Manage team > Members. Remove the guest, then add them again using their email address. This triggers a new invitation and re-establishes the membership. If you have many guests, use PowerShell to bulk-remove and re-add them.
4. Verify SharePoint site permissions
   Go to SharePoint admin center > Active sites. Find the site associated with the team. Select the site and choose “Sharing.” Confirm that “Anyone with the link” or “People in your organization” is allowed. Then go to Site permissions and add the guest explicitly with the required role. This ensures the site-level permissions match the team membership.
5. Check external collaboration settings in Azure AD
   Go to Azure Active Directory > External Identities > External collaboration settings. Ensure that “Guest invite restrictions” is set to “Anyone can invite guests.” Also check “Collaboration restrictions” to make sure the guest’s domain is not blocked. If the domain was blocked, remove it and resend the invitation.
6. Use PowerShell to re-sync guest accounts
   If the above steps fail, use the Microsoft Graph PowerShell SDK to update the guest’s user object. Connect to Microsoft Graph, find the guest by email, and update the “otherMails” attribute to match the current email. Then force a sync by running Update-MgUser with the new UPN.

If Guest Still Has Issues After the Main Fix

Guest sees “You don’t have access” when opening the team’s SharePoint site

This indicates the site-level permissions are broken even though the guest is in the team. Go to the SharePoint site, click the gear icon, and choose “Site permissions.” Add the guest with “Edit” or “Full Control” as needed. Also, check if the site has “Limited access” sharing mode that blocks guests. Change the sharing mode to “Anyone with the link” if appropriate.

Guest cannot find the team in the Teams app after migration

The guest may still see the old team from the previous tenant. Ask them to sign out of Teams and sign in again. If the problem persists, clear the Teams cache on their device. Delete the folder under %appdata%\Microsoft\Teams and restart the app. The guest should then see the new team invitation.

Guest’s OneDrive files are inaccessible after migration

OneDrive for the guest may have been migrated incorrectly. The guest’s OneDrive site is separate from the team site. Check the guest’s profile in Azure AD and confirm the “OneDrive” tab shows the correct URL. If the URL points to the old tenant, update it manually or use the migration tool to redirect. Then ask the guest to access OneDrive from the app launcher.

Guest receives a “User not found” error when accepting the invitation

This happens when the guest’s email domain is not recognized in the target tenant. Ensure the guest’s domain is added as a verified domain in Azure AD. Go to Azure Active Directory > Custom domain names, add the guest’s domain, and verify it. Then resend the invitation.

Item	Resend Invitation	Update UPN
Description	Sends a new redemption link to the guest	Changes the guest’s user principal name to match the new tenant
When to use	When the guest’s invite link is expired or invalid	When the guest’s email or UPN changed during migration
Time to apply	Immediate	Requires a sign-out and sign-in
Admin role needed	Teams admin or global admin	Global admin
Impact	Re-establishes the guest’s access token	Fixes identity mismatches that block access

After completing these steps, test the guest access by asking the guest to open the team and a file from the Files tab. If the guest still faces issues, use the Teams admin center’s “Diagnose” feature to run a connectivity check. Also, verify the guest’s account status in Azure AD to ensure it is not disabled. For large migrations, consider using a third-party migration tool that preserves guest permissions automatically.